Is there a public PoC exploit available for CVE-2025-12337?

Yes, a public proof-of-concept exploit is available for CVE-2025-12337. Prioritise patching immediately. EPSS: 0.0%.

Retro Basketball Shoes Online Store CVE-2025-12337

Q: What is the CVSS score of CVE-2025-12337?

CVE-2025-12337 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-28 cna@vuldb.com

PHP SQLi Retro Basketball Shoes Online Store Campcodes

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Admin path implies at minimum low-privilege authentication; partial DB read/write/disruption yields Low C/I/A; no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:07 vuln.today

CVE Published

Oct 28, 2025 - 01:16 cve.org

MEDIUM 5.5

DescriptionCVE.org

A security flaw has been discovered in Campcodes Retro Basketball Shoes Online Store 1.0. This affects an unknown part of the file /admin/admin_feature.php. Performing a manipulation of the argument pid results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 exposes the admin panel endpoint /admin/admin_feature.php to database manipulation via the unsanitized pid parameter. The provided CVSS 4.0 vector asserts PR:N (no privileges required), though the /admin/ path suggests authentication may be in play - this discrepancy is noted and should be verified against the actual application. A publicly available proof-of-concept exploit exists on GitHub, though the EPSS score of 0.01% (1st percentile) indicates real-world exploitation attempts remain negligible, consistent with the product's obscure deployment footprint. No vendor-released patch has been identified at time of analysis.

Technical ContextAI

The affected application is a PHP-based online retail demo distributed by Campcodes (CPE: cpe:2.3:a:campcodes:retro_basketball_shoes_online_store:1.0). The vulnerability resides in /admin/admin_feature.php, where the pid parameter is passed directly into a SQL query without adequate sanitization or parameterization. The root cause is classified as CWE-74 (Injection), the broad injection class that encompasses CWE-89 (SQL Injection) - the specific sub-type evident from the description and tags. This class of flaw arises when user-controlled input is concatenated into a query string rather than being bound via prepared statements or stored procedures. The backend database engine is not specified in available data, but PHP applications in this category commonly use MySQL or MariaDB.

RemediationAI

No vendor-released patch has been identified at time of analysis - the fix status is unconfirmed. The PoC and vulnerability report are tracked at https://vuldb.com/?id.330124 and https://github.com/HYLCXH/CVE/issues/15. As an immediate compensating control, administrators should restrict access to /admin/admin_feature.php at the web server or firewall level, limiting it to trusted IP ranges only - this reduces the network attack surface without requiring application changes. Additionally, deploying a web application firewall (WAF) rule to detect and block SQL metacharacter sequences in the pid parameter provides a secondary layer of defense; note that WAF rules can produce false positives if pid values legitimately contain special characters. The most durable remediation is to refactor the SQL query in admin_feature.php to use parameterized queries or prepared statements via PDO or MySQLi, eliminating the injection surface entirely.